Out-of-window visit: is it a deviation, and how do I write it up?

Yes, almost always. If the protocol says Week 4 happens on Day 28 plus or minus 3 and the subject came on Day 34, the visit was done outside what the protocol specified, and that is what a protocol deviation is. Whether it has to go to the IRB is a separate question, and the answer lives in three places: the protocol, the sponsor's deviation rules, and your site's SOP. Most out-of-window visits that did not put the subject at risk or damage the data get logged and explained at the site; the ones that did get reported promptly. Below is the arithmetic, the decision path, and a write-up skeleton you can paste into your site's own note-to-file template.

Out of window, in dates

Start with the sample schedule I use for every example on this site. Week 4 is Day 28 with a window of 3 days either side. Subject 012 was randomized on 2026-09-01, so:

• Target: Day 28 = 2026-09-29
• Window opens: Day 25 = 2026-09-26
• Window closes: Day 31 = 2026-10-02

She came in on 2026-10-05. The visit happened and the data exists. It is 6 days past target and 3 days past the close of the window. That is an out-of-window visit: a done visit whose actual date falls outside opens-to-closes.

Compare that with a missed visit: the window closed on 2026-10-02 and nobody came. No data. The log gets a line either way, but a missed visit is a hole and an out-of-window visit is data with an asterisk. Whether Week 8 now counts from randomization or from the visit actually done is a re-anchoring question, and I wrote it up in the visit was missed, which date do you count from now. In the sample protocol everything anchors on randomization, so Week 8 stays Day 56 = 2026-10-27, window 2026-10-22 to 2026-11-01. The late Week 4 does not move it.

Two arithmetic traps. "Days out" means either days past target (6) or days outside the window (3); sponsor logs usually want the second, some CRAs ask for the first, so write both. And if your protocol numbers randomization as Day 1 rather than Day 0, every date above shifts by one. Check the schedule of assessments footnote before you trust anybody's spreadsheet, including mine.

Is an out of window visit a protocol deviation?

Per the protocol, yes. The window is part of the study design, and ICH E6(R3) says the investigator "should follow the protocol and deviate only where necessary to eliminate an immediate hazard(s) to trial participants" (section 2.5.4) and "should document all protocol deviations" (section 2.5.3). In the US the same idea sits in 21 CFR 312.66: the investigator will not make changes in the research without IRB approval except where necessary to eliminate apparent immediate hazards. A visit done late is a change nobody approved in advance.

What trips people up is that "deviation" and "reportable" are not the same word. E6(R3) draws the line at important protocol deviations: "a subset of protocol deviations that may significantly impact the completeness, accuracy and/or reliability of the trial data or that may significantly affect a participant's rights, safety or well-being" (section 3.9.3), and it puts the job of defining trial-specific criteria for "important" on the sponsor. So the first place to look is the protocol's deviation section. Some say outright that a visit a few days late is not important unless dosing or a PK assessment was affected. Some are silent, which means the CRA decides on the call.

FDA has a draft guidance on protocol deviations from December 2024 that adopts the same two-tier framing; its page notes that FDA regulations themselves do not define the term. It was still a draft when I checked.

IRBs sort deviations into their own buckets, and the out-of-window visit sits on both sides of the line depending on impact. UVA's HRPP page on protocol deviations, non-compliance and protocol exceptions uses "study visit outside protocol window" as its opening example of a deviation, then lists it as major when it results in "significant increase in potential for risk to the subject or damage to the integrity or completeness of the data" and as minor when "there is no increased potential for risk to the subject or any damage to the integrity or completeness of the data." Major goes to that IRB within seven calendar days; minor stays in the regulatory file, and the same page recommends a minor-deviation log or a note to file for exactly that. UBC's Protocol Deviations 101 has the same shape: an "out-of-window follow up visit" is its example of a deviation that can be minor, while the ethics board wants the ones that increase risk, compromise the study, are repetitive, alter eligibility, or touch privacy.

Notice "repetitive." One Week 4 visit three days late is minor almost everywhere. The fourth one this quarter is a pattern, and patterns are what IRBs and monitors care about, which is the reason to keep the log honest when nothing is reportable. You will also hear "violation" in some hallways; E6(R3) says deviation, your IRB may say major and minor, and the word matters less than which list yours lands on. That is what protocols and SOPs usually say and why. Yours governs.

The decision path when you can see it coming

Most out-of-window visits announce themselves. The subject calls on Thursday and says she cannot come until the week after next. Here is the order I walk.

1. Look at the window before you answer. If the date she is offering is still inside opens-to-closes, it is a reschedule, not a deviation. Sample protocol, Week 4: anything from 2026-09-26 through 2026-10-02 is fine.
2. If it falls outside, call the CRA before the visit, not after. Some protocols say a visit outside the window should still be performed; some say skip it and treat it as missed; some say it depends on the visit. A sponsor's answer given before the visit is worth far more in the file than one asked for afterward. Put the date and the answer in the note.
3. Do the visit if the protocol or sponsor says to. Late data usually beats no data. But ask specifically about the time-sensitive procedures; that is where "do it anyway" gets complicated. More below.
4. Log it the same day. Subject, visit, window, actual date, days out, reason. Do not wait for the monitor to find it.
5. Note to file per your site SOP. Some sites explain it in the visit source and skip the note; some require a note for anything outside the window; some only when it hits the sponsor's important list. The skeleton below fits any of them.
6. IRB per protocol, sponsor, and SOP. Run it against the criteria your IRB publishes. Risk, data integrity, or pattern: it goes in on their timeline. Otherwise it waits for the log at continuing review. Make the call with the PI, and write down that you did.

If the visit sneaks up on you after the fact, the path is the same minus step 2, and the note says so: discovered on such a date during such a check.

What changes when the visit is done late

The deviation log is about when. It holds the window, the date, and the count of days. What it does not hold is who, what, and where, and a visit done late frequently changes what should be done at it.

A PK draw timed to the dose has a window of its own, often hours, and on the wrong day the sample may be uninterpretable or unwanted. Drug dispensing outside the window can mean the subject runs out before the next visit, or that the dosing interval needs a sponsor decision. A questionnaire about "the past two weeks" now covers a different two weeks. Each of these is a line on the visit's run sheet: what gets done at Week 4, in what order, how your site does it, and who is delegated to do it. When the visit is late, that list is what you walk through with the CRA: this stays, this gets dropped, this moves to Week 8. The dropped procedures are deviations of their own, and the run sheet is how you see them instead of discovering them at the monitoring visit. I lost PK data to an out-of-window visit as a coordinator, and the sheet I had at the time did not show me what the late date had cost until the monitor did.

The write-up

This is a skeleton for your site's own note-to-file template, not a form and not a source record. The visit's source documents stay the source; the note explains the one thing they cannot, which is why. Copy it into whatever your SOP calls the note, keep the headings your QA lead expects, and delete the rest.

NOTE TO FILE -- OUT-OF-WINDOW VISIT

Protocol:            [protocol number, short title]
Subject:             [subject ID only]
Visit:               [Week 4 / Visit 5]
Protocol window:     Day 28 +/- 3 (Day 25 to Day 31)
Anchor date:         [Randomization] 2026-09-01
Target date:         2026-09-29
Window:              2026-09-26 to 2026-10-02
Actual visit date:   2026-10-05
Days outside window: 3        Days from target: 6

Reason (in the subject's words, as told to us):
  "[...]"

Sponsor contacted:   [CRA name], [date], [before / after visit]
Sponsor instruction: [proceed with all assessments / proceed, omit ___ / treat as missed]

Impact on data:      [none identified / PK sample not drawn / ___ assessment omitted]
Impact on safety:    [none identified / describe]
Assessments not done and where they are captured: [CRF page / deviation log]

PI aware:            [initials] [date]
Sponsor notified:    [date] [how]
IRB:                 [not reportable per site SOP section ___ / reported (date)]
Corrective action:   [what changes so the next one does not happen]

[Name, role]  [initials]  [date written]

Four habits make the note worth reading a year later. The reason is in the subject's words, not "subject was non-compliant," which is a judgment and tells the monitor nothing. Both day counts are there so nobody recomputes them. The sponsor's instruction is quoted with a date, so the choice to proceed is theirs on paper. And the IRB line says why it is or is not reportable, citing the SOP section. Date the note when you write it, not when the visit happened; if the deviation surfaced a month later at a monitoring visit, the note says that too.

Catching the next one a week earlier

Almost every out-of-window visit I have seen was visible seven days before it happened. The window was going to open on a Saturday; nobody looked at the calendar until Friday afternoon; the earliest slot was the following Wednesday, two days past close. The fix is not a better note. It is a tracker that shows windows a week out with an "opens soon" state, so the call happens while the whole window is still ahead of you and the reschedule lands inside it. If you are on a spreadsheet, the visit-window tracker template on this site computes opens, closes, and days-until from the anchor date, so that column exists without you maintaining it by hand.

The other half of prevention is on the day of the late visit itself: a printed list of what Week 4 is supposed to include, so a dropped PK draw is a decision you made with the CRA at 9 a.m. and not something you notice in the deviation log in November.